CVE-2025-30366 - WeGIA vulnerable to Stored XSS in personalizacao.php · CoreCVE

Back Back to CVE browser

MEDIUM

WeGIA vulnerable to Stored XSS in personalizacao.php

Published Mar 27, 2025

6.2

MEDIUM

CVSS 4.0

EPSS 0.27%

Description

WeGIA is a Web manager for charitable institutions. Versions prior to 3.2.8 are vulnerable to stored cross-site scripting. This vulnerability allows unauthorized scripts to be executed within the user's browser context. Stored XSS is particularly critical, as the malicious code is permanently stored on the server and executed whenever a compromised page is loaded, affecting all users accessing this page. Version 3.2.8 fixes the issue.

Affected products

Vendor LabRedesCefetRJ Product WeGIA Default
n/a
- Version
  < 3.2.8
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

LabRedesCefetRJ

n/a

Version	Status	Constraints
< 3.2.8	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (1)

https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-pwr9-fr8r-8h48
exploitx_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-pwr9-fr8r-8h48		exploitx_refsource_CONFIRMVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner GitHub_M

Published Mar 27, 2025

Updated Mar 27, 2025

Reserved Mar 21, 2025

Link CVE-2025-30366

CISA Vulnrichment

Updated Mar 27, 2025

Status Analyzed

Modified Jun 17, 2026

Link CVE-2025-30366

Severity n/a

Public date n/a

Links CVE-2025-30366